TY - GEN
T1 - Firewall packet matching optimization using network traffic behavior and packet matching statistics
AU - Trabelsi, Zouheir
AU - Sayed, Hishem El
AU - Zeidan, Safaa
PY - 2012
Y1 - 2012
N2 - In this paper, we present a mechanism that utilizes network traffic behavior and packet matching statistics to optimize dynamically the ordering of the firewall filtering rules. The proposed technique segments the traffic space, calculates the matching rate for each filtering rule and deduces statistics means and variances over a predefined window of segments. The means and variances are used to update the positions of the filtering rules in the security policy. Through experiments using simulated firewall and network traffic generator, the proposed mechanism is shown to be efficient and easy to deploy in practical firewall implementation. This work demonstrates that the use of dynamic rule-ordering improves the filtering processing time and allows firewall administrators to analyze further the network traffic behavior and accordingly adjust the initial order of the filtering rules.
AB - In this paper, we present a mechanism that utilizes network traffic behavior and packet matching statistics to optimize dynamically the ordering of the firewall filtering rules. The proposed technique segments the traffic space, calculates the matching rate for each filtering rule and deduces statistics means and variances over a predefined window of segments. The means and variances are used to update the positions of the filtering rules in the security policy. Through experiments using simulated firewall and network traffic generator, the proposed mechanism is shown to be efficient and easy to deploy in practical firewall implementation. This work demonstrates that the use of dynamic rule-ordering improves the filtering processing time and allows firewall administrators to analyze further the network traffic behavior and accordingly adjust the initial order of the filtering rules.
KW - Firewall
KW - dynamic rule ordering
KW - filtering rules
UR - http://www.scopus.com/inward/record.url?scp=84863688043&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84863688043&partnerID=8YFLogxK
U2 - 10.1109/ComNet.2012.6217735
DO - 10.1109/ComNet.2012.6217735
M3 - Conference contribution
AN - SCOPUS:84863688043
SN - 9781467310079
T3 - 3rd International Conference on Communications and Networking, ComNet 2012
BT - 3rd International Conference on Communications and Networking, ComNet 2012
T2 - 2012 3rd International Conference on Communications and Networking, ComNet 2012
Y2 - 29 March 2012 through 1 April 2012
ER -